Coraza JSON Body Processor Dot Separation Bypass

Executive Summary

This vulnerability affects Coraza WAF versions 3.0.0 to 3.8.0. It involves a JSON body processor that flattens nested properties into dot-separated ARGS_POST names without escaping literal dots. This causes distinct properties to collide, allowing unauthenticated attackers to overwrite malicious nested values with seemingly safe ones, bypassing OWASP CRS rules while backend systems still receive the malicious payloads.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect Coraza WAF logs for JSON body processing anomalies where nested properties collide into dot-separated ARGS_POST names. Check for duplicate keys like account.role overwriting nested values. Use Coraza debug mode to log ARGS_POST collections and compare with backend JSON parsing.

Useful 0 Not Useful 0

Impact Analysis

Unauthenticated attackers can exploit this to hide SQL injection payloads or other malicious inputs from WAF inspection. This could lead to unauthorized access, data manipulation, or other attacks on backend systems that rely on Coraza for protection. The impact depends on the backend's ability to handle malformed inputs.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could undermine compliance efforts by allowing unauthorized data access or manipulation, which violates principles of data integrity and confidentiality required by GDPR and HIPAA. Organizations using affected Coraza versions may fail security audits or risk regulatory penalties if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Coraza WAF to version 3.8.1 or later to address the JSON key collision flaw. If immediate upgrade isn't possible, disable JSON body processing in Coraza or implement custom input validation to escape dots in JSON keys before processing.

Useful 0 Not Useful 0